From 1887053ecf8b3cbe5758282ee1e9db083db632a4 Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Tue, 3 Nov 2026 08:20:51 +0000
Subject: [PATCH 1/2] OSS-Fuzz: Add new fuzzer/corpus/dict targets tree exec

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 cmake/fuzzing_build.cmake                     |   2 +-
 fuzzing/bt_tree_exec_fuzzer.cpp               | 434 ++++++++++++++++++
 .../ifthenelse-whiledoelse                    | Bin 0 -> 42 bytes
 fuzzing/corpus/bt_tree_exec_fuzzer/loopint    | Bin 0 -> 27 bytes
 .../corpus/bt_tree_exec_fuzzer/parallel-sleep | Bin 0 -> 32 bytes
 .../bt_tree_exec_fuzzer/parallelall-delay     | Bin 0 -> 33 bytes
 .../bt_tree_exec_fuzzer/precondition-loopint  | Bin 0 -> 31 bytes
 .../reactiveseq-repeat-retry                  | Bin 0 -> 35 bytes
 .../seq-script-timeout-repeat                 | Bin 0 -> 35 bytes
 .../bt_tree_exec_fuzzer/seqmem-set-unset      | Bin 0 -> 32 bytes
 .../bt_tree_exec_fuzzer/substitution-named    | Bin 0 -> 28 bytes
 .../corpus/bt_tree_exec_fuzzer/subtree-doc    | Bin 0 -> 28 bytes
 fuzzing/corpus/bt_tree_exec_fuzzer/switch2    | Bin 0 -> 32 bytes
 fuzzing/corpus/bt_tree_exec_fuzzer/trycatch   | Bin 0 -> 31 bytes
 fuzzing/dictionaries/bt_tree_exec_fuzzer.dict |  66 +++
 15 files changed, 501 insertions(+), 1 deletion(-)
 create mode 100644 fuzzing/bt_tree_exec_fuzzer.cpp
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/ifthenelse-whiledoelse
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/loopint
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/parallel-sleep
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/parallelall-delay
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/precondition-loopint
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/reactiveseq-repeat-retry
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/seq-script-timeout-repeat
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/seqmem-set-unset
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/substitution-named
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/subtree-doc
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/switch2
 create mode 100644 fuzzing/corpus/bt_tree_exec_fuzzer/trycatch
 create mode 100644 fuzzing/dictionaries/bt_tree_exec_fuzzer.dict

diff --git a/cmake/fuzzing_build.cmake b/cmake/fuzzing_build.cmake
index 43f367001..354287121 100644
--- a/cmake/fuzzing_build.cmake
+++ b/cmake/fuzzing_build.cmake
@@ -106,7 +106,7 @@ endfunction()
 
 # Function to add fuzzing targets - compatible with both local and OSS-Fuzz builds
 function(add_fuzzing_targets)
-  set(FUZZERS bt_fuzzer script_fuzzer bb_fuzzer)
+  set(FUZZERS bt_fuzzer script_fuzzer bb_fuzzer bt_tree_exec_fuzzer)
 
   foreach(fuzzer ${FUZZERS})
     add_executable(${fuzzer} fuzzing/${fuzzer}.cpp)
diff --git a/fuzzing/bt_tree_exec_fuzzer.cpp b/fuzzing/bt_tree_exec_fuzzer.cpp
new file mode 100644
index 000000000..63cec6e54
--- /dev/null
+++ b/fuzzing/bt_tree_exec_fuzzer.cpp
@@ -0,0 +1,434 @@
+// Fuzz target: bt_tree_exec_fuzzer
+//
+// Threat model (see fuzzing/README.md and the coverage-pipeline report):
+// Behavior trees are frequently loaded from untrusted sources (files, network
+// APIs, editor payloads). The existing bt_fuzzer covers XML *parsing* only:
+// it never ticks a tree, so the whole execution engine (control nodes,
+// decorators, tree_node/behavior_tree state machines, ports at runtime,
+// substitution rules, wake-up/timer machinery) is dark in production coverage.
+//
+// This harness generates *structurally valid* XML over the builtin node set,
+// creates the tree, and actually drives it: repeated tickRoot() calls until a
+// terminal status, halt() while RUNNING, re-tick after halt, SubTree
+// references, scripting enums, substitution rules (incl. wildcard filters) and
+// a typed blackboard. All generated values are bounded (depth, children,
+// Repeat/Retry counts never -1, Sleep/Timeout/Delay/Delayed-Test in the low
+// milliseconds) so that no input can make the harness hang or blow memory.
+//
+// Expected bug classes: state-machine logic violations, use-after-free/dangling
+// node handling on halt-while-RUNNING, out-of-bounds child indexing in control
+// nodes, numeric parsing of attributes, scripting runtime errors.
+
+#include "behaviortree_cpp/bt_factory.h"
+#include "behaviortree_cpp/blackboard.h"
+#include "behaviortree_cpp/xml_parsing.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+namespace
+{
+
+constexpr int kMaxDepth = 3;
+constexpr unsigned kMaxTicks = 8;
+
+const char* kNames[] = { "n1", "act", "cond", "root_task", "aux" };
+
+// Scripts used by Script/ScriptCondition/Precondition/TestNode. All short,
+// terminating and side-effect limited to the blackboard.
+const char* kConditionScripts[] = {
+  "var > 0", "var < 5", "flag", "!flag", "dbl < 10.0", "str == 'abc'",
+  "var == MODE_A"
+};
+const char* kActionScripts[] = {
+  "var = var + 1", "var = 3", "var = var - 1", "str = 'fuzz'",
+  "dbl = var * 0.5", "flag = !flag", "var = MODE_A", "flag = var > 2"
+};
+const char* kLiterals[] = { "1", "2", "true", "false", "1.5", "hello", "{var}" };
+const char* kStatuses[] = { "SUCCESS", "FAILURE", "SKIPPED" };
+
+std::string pickName(FuzzedDataProvider& fdp)
+{
+  return fdp.PickValueInArray(kNames);
+}
+
+std::string pickScript(FuzzedDataProvider& fdp)
+{
+  return fdp.PickValueInArray(kActionScripts);
+}
+
+std::string pickCondition(FuzzedDataProvider& fdp)
+{
+  return fdp.PickValueInArray(kConditionScripts);
+}
+
+// A condition-like leaf: ScriptCondition / AlwaysSuccess / AlwaysFailure.
+std::string genConditionLeaf(FuzzedDataProvider& fdp)
+{
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
+  {
+    case 0:
+      return "<ScriptCondition code=\"" + pickCondition(fdp) + "\"/>";
+    case 1:
+      return "<AlwaysSuccess/>";
+    default:
+      return "<AlwaysFailure/>";
+  }
+}
+
+// Leaf actions. Occasionally blackboard-remap a port ("{key}" syntax).
+std::string genLeaf(FuzzedDataProvider& fdp)
+{
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 8))
+  {
+    case 0:
+      return "<AlwaysSuccess/>";
+    case 1:
+      return "<AlwaysFailure/>";
+    case 2:
+      return "<Script code=\"" + pickScript(fdp) + "\"/>";
+    case 3:
+      return "<ScriptCondition code=\"" + pickCondition(fdp) + "\"/>";
+    case 4:
+    {
+      if(fdp.ConsumeBool())
+      {
+        return std::string("<SetBlackboard output_key=\"var2\" value=\"") +
+               fdp.PickValueInArray(kLiterals) + "\"/>";
+      }
+      return "<SetBlackboard output_key=\"var2\" value=\"{var}\"/>";
+    }
+    case 5:
+      return "<Sleep msec=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 5)) + "\"/>";
+    case 6:
+      return "<UnsetBlackboard key=\"var2\"/>";
+    case 7:
+      return "<Script code=\"{txt}\"/>";
+    default:
+    {
+      if(fdp.ConsumeBool())
+      {
+        return "<Script code=\"" + pickScript(fdp) + "\" name=\"" + pickName(fdp) +
+               "\"/>";
+      }
+      return "<AlwaysSuccess name=\"" + pickName(fdp) + "\"/>";
+    }
+  }
+}
+
+std::string genDecorator(FuzzedDataProvider& fdp, int depth);
+std::string genControl(FuzzedDataProvider& fdp, int depth);
+
+std::string genNode(FuzzedDataProvider& fdp, int depth)
+{
+  if(depth >= kMaxDepth)
+  {
+    return genLeaf(fdp);
+  }
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
+  {
+    case 0:
+      return genLeaf(fdp);
+    case 1:
+      return genDecorator(fdp, depth);
+    default:
+      return genControl(fdp, depth);
+  }
+}
+
+std::string genDecorator(FuzzedDataProvider& fdp, int depth)
+{
+  const std::string child = genNode(fdp, depth + 1);
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 10))
+  {
+    case 0:
+      return "<Inverter>" + child + "</Inverter>";
+    case 1:
+      return "<ForceSuccess>" + child + "</ForceSuccess>";
+    case 2:
+      return "<ForceFailure>" + child + "</ForceFailure>";
+    case 3:
+      return "<KeepRunningUntilFailure>" + child + "</KeepRunningUntilFailure>";
+    case 4:
+      return "<RunOnce then_skip=\"" +
+             std::string(fdp.ConsumeBool() ? "true" : "false") + "\">" + child +
+             "</RunOnce>";
+    case 5:
+      // never -1: that would be an infinite loop
+      return "<Repeat num_cycles=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<int>(0, 4)) + "\">" + child +
+             "</Repeat>";
+    case 6:
+      // never -1
+      return "<RetryUntilSuccessful num_attempts=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<int>(1, 4)) + "\">" + child +
+             "</RetryUntilSuccessful>";
+    case 7:
+      return "<Timeout msec=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 50)) + "\">" +
+             child + "</Timeout>";
+    case 8:
+      return "<Delay delay_msec=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 10)) + "\">" +
+             child + "</Delay>";
+    case 9:
+      return "<Precondition if=\"" + pickCondition(fdp) + "\" else=\"" +
+             std::string(fdp.PickValueInArray(kStatuses)) + "\">" + child +
+             "</Precondition>";
+    default:
+      return std::string("<LoopInt queue=\"1;2;3\" value=\"{loopv}\" if_empty=\"") +
+             fdp.PickValueInArray(kStatuses) + "\">" + child + "</LoopInt>";
+  }
+}
+
+std::string genChildrenBody(FuzzedDataProvider& fdp, int depth, size_t count)
+{
+  std::string body;
+  for(size_t i = 0; i < count; i++)
+  {
+    body += genNode(fdp, depth + 1);
+  }
+  return body;
+}
+
+std::string genControl(FuzzedDataProvider& fdp, int depth)
+{
+  const size_t n = fdp.ConsumeIntegralInRange<size_t>(1, 3);
+  switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 10))
+  {
+    case 0:
+      return "<Sequence>" + genChildrenBody(fdp, depth, n) + "</Sequence>";
+    case 1:
+      return "<ReactiveSequence>" + genChildrenBody(fdp, depth, n) +
+             "</ReactiveSequence>";
+    case 2:
+      return "<SequenceWithMemory>" + genChildrenBody(fdp, depth, n) +
+             "</SequenceWithMemory>";
+    case 3:
+      return "<Fallback>" + genChildrenBody(fdp, depth, n) + "</Fallback>";
+    case 4:
+      return "<ReactiveFallback>" + genChildrenBody(fdp, depth, n) +
+             "</ReactiveFallback>";
+    case 5:
+    {
+      const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
+      return "<Parallel success_count=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
+             "\" failure_count=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
+             "\">" + genChildrenBody(fdp, depth, children) + "</Parallel>";
+    }
+    case 6:
+    {
+      const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
+      return "<ParallelAll failure_count=\"" +
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
+             "\">" + genChildrenBody(fdp, depth, children) + "</ParallelAll>";
+    }
+    case 7:
+      // first child must be the condition branch
+      return "<IfThenElse>" + genConditionLeaf(fdp) + genNode(fdp, depth + 1) +
+             "</IfThenElse>";
+    case 8:
+      // first child must be the condition branch
+      return "<WhileDoElse>" + genConditionLeaf(fdp) + genNode(fdp, depth + 1) +
+             "</WhileDoElse>";
+    case 9:
+      // exactly NUM_CASES children plus the default one
+      return "<Switch2 variable=\"{var}\" case_1=\"1\" case_2=\"2\">" +
+             genChildrenBody(fdp, depth, 3) + "</Switch2>";
+    default:
+      // btcpp-1 (findings/bt_tree_exec_fuzzer): TryCatchNode::halt() executes
+      // its catch child when catch_on_halt is true; a throwing catch child
+      // (e.g. a SetBlackboard type conflict on hostile input) then escapes
+      // haltTree() and aborts the process via the noexcept Tree destructor.
+      // Until upstream fixes that, only catch_on_halt="false" is generated;
+      // the attribute is still present for parser coverage.
+      return "<TryCatch catch_on_halt=\"false\">" +
+             genChildrenBody(fdp, depth, fdp.ConsumeIntegralInRange<size_t>(2, 3)) +
+             "</TryCatch>";
+  }
+}
+
+std::string wrapTree(const std::string& tree_id, const std::string& body)
+{
+  return "<BehaviorTree ID=\"" + tree_id + "\">" + body + "</BehaviorTree>";
+}
+
+// Drive a created tree: at most kMaxTicks single ticks, optionally halt()
+// mid-flight while RUNNING, always halt() at the end, and optionally re-tick
+// after halt. Only the bounded tickExactlyOnce()/tickOnce() entry points are
+// used: tickWhileRunning() has no internal bound and would hang forever on
+// trees like KeepRunningUntilFailure[AlwaysSuccess], which the grammar is
+// allowed to generate.
+//
+// btcpp-1 routing (see findings/bt_tree_exec_fuzzer/README.md): every tick and
+// halt is wrapped, so a BT exception raised by a hostile tree is contained here
+// and is NEVER in flight while the Tree object is destructed. Tree::~Tree()
+// calls haltTree() in an implicitly-noexcept context; an exception escaping it
+// (observed: NodeExecutionError from a SetBlackboard type conflict re-thrown
+// during unwinding) aborts the process via std::terminate. That abort is a
+// real upstream defect, not a harness artifact; containing the exception here
+// constructs valid API usage while continuing to fuzz the same surface.
+namespace
+{
+void safeHaltTree(BT::Tree& tree)
+{
+  try
+  {
+    tree.haltTree();
+  }
+  catch(const std::exception&)
+  {
+    // btcpp-1 routing: never let a BT exception escape this scope.
+  }
+}
+}  // namespace
+
+void driveTree(BT::Tree& tree, FuzzedDataProvider& fdp)
+{
+  const unsigned ticks = fdp.ConsumeIntegralInRange<unsigned>(1, kMaxTicks);
+  const unsigned halt_at = fdp.ConsumeIntegralInRange<unsigned>(0, ticks);
+  // The bool is still consumed (corpus inputs stay byte-stable) but the
+  // wakeup-aware tick is deliberately not used, see the comment below.
+  const bool wakeup_aware = fdp.ConsumeBool();
+  (void)wakeup_aware;
+  for(unsigned i = 1; i <= ticks; i++)
+  {
+    BT::NodeStatus status;
+    try
+    {
+      // Only tickExactlyOnce() is safe here: both tickOnce()
+      // (ONCE_UNLESS_WOKEN_UP) and tickWhileRunning() run an *internally
+      // unbounded* wake-up re-tick loop (Tree::tickRoot's inner
+      // `while (wake_up_->waitFor(0))`). With self-re-arming millisecond
+      // timers (e.g. Delay[KeepRunningUntilFailure[...]], which the grammar
+      // legitimately generates) a single call can spin for tens of seconds
+      // and blow the libFuzzer timeout. The wake-up/timer machinery itself is
+      // still exercised by the nodes' timers firing during the run.
+      status = tree.tickExactlyOnce();
+    }
+    catch(const std::exception&)
+    {
+      // btcpp-1 routing: contain node errors on hostile input so that no
+      // exception is ever in flight while the Tree is destructed.
+      safeHaltTree(tree);
+      return;
+    }
+    if(i == halt_at && status == BT::NodeStatus::RUNNING)
+    {
+      safeHaltTree(tree);
+    }
+    if(status != BT::NodeStatus::RUNNING)
+    {
+      break;
+    }
+  }
+  safeHaltTree(tree);
+  if(fdp.ConsumeBool())
+  {
+    try
+    {
+      (void)tree.tickExactlyOnce();
+    }
+    catch(const std::exception&)
+    {
+      // btcpp-1 routing: contain node errors on hostile input.
+    }
+    safeHaltTree(tree);
+  }
+}
+
+
+// A small substitution-rules JSON: replaces matched nodes with TestNodes
+// (bounded async_delay) and uses a wildcard filter so that the wildcard
+// matching code is exercised too.
+const char* kSubstitutionJson =
+    "{ \"TestNodeConfigs\": {"
+    "\"T1\": { \"return_status\": \"SUCCESS\", \"async_delay\": 1, "
+    "\"post_script\": \"flag = true\" },"
+    "\"T2\": { \"return_status\": \"FAILURE\" },"
+    "\"T3\": { \"return_status_script\": \"(var > 2) ? FAILURE : SUCCESS\" } },"
+    "\"SubstitutionRules\": {"
+    "\"cond\": \"T1\", \"act\": \"T2\", \"n1\": \"T3\", \"*_task\": \"T1\" } }";
+
+}  // namespace
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+  if(size < 16)
+  {
+    return 0;
+  }
+  FuzzedDataProvider fdp(data, size);
+
+  BT::BehaviorTreeFactory factory;
+  factory.registerScriptingEnum("MODE_A", 1);
+  factory.registerScriptingEnum("MODE_B", 2);
+
+  auto blackboard = BT::Blackboard::create();
+  blackboard->set("var", 1);
+  blackboard->set("dbl", 1.5);
+  blackboard->set("str", std::string("abc"));
+  blackboard->set("flag", true);
+  blackboard->set("txt", std::string("var = 2"));
+
+  try
+  {
+    switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
+    {
+      case 0:
+      {
+        // plain create + tick
+        const std::string xml =
+            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
+            "</root>";
+        auto tree = factory.createTreeFromText(xml, blackboard);
+        driveTree(tree, fdp);
+        break;
+      }
+      case 1:
+      {
+        // multiple trees in one document + SubTree reference
+        const std::string xml =
+            "<root BTCPP_format=\"4\">" +
+            wrapTree("MainTree",
+                     "<Sequence><SubTree ID=\"AuxTree\"/>" + genNode(fdp, 0) +
+                         "</Sequence>") +
+            wrapTree("AuxTree", genLeaf(fdp)) + "</root>";
+        factory.registerBehaviorTreeFromText(xml);
+        auto tree = factory.createTree("MainTree", blackboard);
+        driveTree(tree, fdp);
+        break;
+      }
+      default:
+      {
+        // registry + TestNode substitutions (incl. wildcard filter)
+        const std::string xml =
+            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
+            "</root>";
+        factory.registerBehaviorTreeFromText(xml);
+        factory.loadSubstitutionRuleFromJSON(kSubstitutionJson);
+        const auto& names = factory.registeredBehaviorTrees();
+        if(!names.empty())
+        {
+          auto tree = factory.createTree(names.front(), blackboard);
+          driveTree(tree, fdp);
+        }
+        break;
+      }
+    }
+  }
+  catch(const std::exception&)
+  {
+    // BT raises RuntimeError/LogicError on malformed input: expected here.
+  }
+
+  return 0;
+}
+
diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/ifthenelse-whiledoelse b/fuzzing/corpus/bt_tree_exec_fuzzer/ifthenelse-whiledoelse
new file mode 100644
index 0000000000000000000000000000000000000000..89d67c37ba988b223fb8ac8597f93a6ab7709ee1
GIT binary patch
literal 42
icmZ>CL<NkD4D3v-42%pMj0{YyOh5)Zkio#n!~g(~H3UKc

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/loopint b/fuzzing/corpus/bt_tree_exec_fuzzer/loopint
new file mode 100644
index 0000000000000000000000000000000000000000..f9bb80f9b51cfa147e077ec42b94805fa6759862
GIT binary patch
literal 27
VcmZ>CL<NkD4D3u?3``7+3;<8`1StRj

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/parallel-sleep b/fuzzing/corpus/bt_tree_exec_fuzzer/parallel-sleep
new file mode 100644
index 0000000000000000000000000000000000000000..897b90874e06b6c642760ba8f449dc1e9c0b2832
GIT binary patch
literal 32
acmZ>CL<NkD4D1XHOsouy42-OdObh^IiUcbF

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/parallelall-delay b/fuzzing/corpus/bt_tree_exec_fuzzer/parallelall-delay
new file mode 100644
index 0000000000000000000000000000000000000000..6aae4de9d3de5c03d63a12d9268ab821a2d0e381
GIT binary patch
literal 33
acmZ>CL<NkD4D1XHj2uABz{tkP!~g(j!UQe=

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/precondition-loopint b/fuzzing/corpus/bt_tree_exec_fuzzer/precondition-loopint
new file mode 100644
index 0000000000000000000000000000000000000000..0515903ba4f0671fd89d7e7e32caa5e86f42697f
GIT binary patch
literal 31
YcmZ>CL<NkD4D1YyoD5tHObkFa0ARQTG5`Po

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/reactiveseq-repeat-retry b/fuzzing/corpus/bt_tree_exec_fuzzer/reactiveseq-repeat-retry
new file mode 100644
index 0000000000000000000000000000000000000000..0d12d193f9a3e59411d58cc3bdaaec1207428fa4
GIT binary patch
literal 35
bcmZ>CL<NkD4D5_-ObiT+jI1Dnk%<8SaX17o

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/seq-script-timeout-repeat b/fuzzing/corpus/bt_tree_exec_fuzzer/seq-script-timeout-repeat
new file mode 100644
index 0000000000000000000000000000000000000000..320a6378d92c2947bc44b8feeb84f55d02f993b3
GIT binary patch
literal 35
ccmZ>CL<NkD4D9T}tW1myKo%1N10xdy0CH;tLjV8(

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/seqmem-set-unset b/fuzzing/corpus/bt_tree_exec_fuzzer/seqmem-set-unset
new file mode 100644
index 0000000000000000000000000000000000000000..dc311b9f4907c6a48842915e215f6aa7f4acd4cf
GIT binary patch
literal 32
acmZ>CL<NkD4D9R-Yzz#HEDTJHObh^I-~=%M

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/substitution-named b/fuzzing/corpus/bt_tree_exec_fuzzer/substitution-named
new file mode 100644
index 0000000000000000000000000000000000000000..e27bd5d35528bb0ee7875f5ce22115dadd0df20b
GIT binary patch
literal 28
UcmZ>CL<NkD4D1Xbz{tb|08_&R9{>OV

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/subtree-doc b/fuzzing/corpus/bt_tree_exec_fuzzer/subtree-doc
new file mode 100644
index 0000000000000000000000000000000000000000..a606b9cf22ee306fd6c2c40b6225d9d27d293b39
GIT binary patch
literal 28
UcmZ>CL<NkD4D1Xbz{tc108_#Q9smFU

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/switch2 b/fuzzing/corpus/bt_tree_exec_fuzzer/switch2
new file mode 100644
index 0000000000000000000000000000000000000000..9dfc961c56594671ce9767aee73a5d619719ef8d
GIT binary patch
literal 32
ZcmZ>CL<I~CEX+&{OiT=nObnbr3;<+<1T6pn

literal 0
HcmV?d00001

diff --git a/fuzzing/corpus/bt_tree_exec_fuzzer/trycatch b/fuzzing/corpus/bt_tree_exec_fuzzer/trycatch
new file mode 100644
index 0000000000000000000000000000000000000000..d7f47120bd577de11af4d355181528c761fb0d83
GIT binary patch
literal 31
ZcmZ>CL<NkD4D2jS42%qnj9iRN3;<w?1TX*q

literal 0
HcmV?d00001

diff --git a/fuzzing/dictionaries/bt_tree_exec_fuzzer.dict b/fuzzing/dictionaries/bt_tree_exec_fuzzer.dict
new file mode 100644
index 000000000..c61e3b01b
--- /dev/null
+++ b/fuzzing/dictionaries/bt_tree_exec_fuzzer.dict
@@ -0,0 +1,66 @@
+# Dictionary for bt_tree_exec_fuzzer: builtin node IDs, port names and
+# scripting tokens used by BehaviorTree.CPP XML documents.
+#
+# XML scaffolding
+"<root BTCPP_format=\"4\">"
+"<BehaviorTree ID=\"MainTree\">"
+"</BehaviorTree>"
+"<SubTree ID=\"AuxTree\"/>"
+"BTCPP_format="
+"ID="
+"name="
+# control nodes
+"<Sequence>"
+"</Sequence>"
+"<ReactiveSequence>"
+"<SequenceWithMemory>"
+"<Fallback>"
+"<ReactiveFallback>"
+"<Parallel success_count=\"1\" failure_count=\"1\">"
+"<ParallelAll failure_count=\"1\">"
+"<IfThenElse>"
+"<WhileDoElse>"
+"<Switch2 variable=\"{var}\" case_1=\"1\" case_2=\"2\">"
+"<TryCatch catch_on_halt=\"true\">"
+# decorators
+"<Inverter>"
+"<ForceSuccess>"
+"<ForceFailure>"
+"<KeepRunningUntilFailure>"
+"<RunOnce then_skip=\"true\">"
+"<Repeat num_cycles=\"2\">"
+"<RetryUntilSuccessful num_attempts=\"2\">"
+"<Timeout msec=\"20\">"
+"<Delay delay_msec=\"5\">"
+"<Precondition if=\"var > 0\" else=\"FAILURE\">"
+"<LoopInt queue=\"1;2;3\" value=\"{loopv}\" if_empty=\"SUCCESS\">"
+# actions / conditions
+"<AlwaysSuccess/>"
+"<AlwaysFailure/>"
+"<Script code=\""
+"<ScriptCondition code=\""
+"<SetBlackboard output_key=\"var2\" value=\"{var}\"/>"
+"<UnsetBlackboard key=\"var2\"/>"
+"<Sleep msec=\"3\"/>"
+"SUCCESS"
+"FAILURE"
+"SKIPPED"
+# scripting tokens
+"var"
+"var2"
+"loopv"
+"dbl"
+"str"
+"flag"
+"txt"
+"MODE_A"
+"MODE_B"
+"{var}"
+"{txt}"
+"var = var + 1"
+"flag = !flag"
+"var > 0"
+"var < 5"
+"str == 'abc'"
+"true"
+"false"

From 8c4073906193ad74a12477af318d9deecf562a04 Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Tue, 3 Nov 2026 09:54:32 +0000
Subject: [PATCH 2/2] Fix fromatting

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 fuzzing/bt_tree_exec_fuzzer.cpp | 78 +++++++++++++--------------------
 1 file changed, 31 insertions(+), 47 deletions(-)

diff --git a/fuzzing/bt_tree_exec_fuzzer.cpp b/fuzzing/bt_tree_exec_fuzzer.cpp
index 63cec6e54..edf9b434d 100644
--- a/fuzzing/bt_tree_exec_fuzzer.cpp
+++ b/fuzzing/bt_tree_exec_fuzzer.cpp
@@ -19,17 +19,17 @@
 // node handling on halt-while-RUNNING, out-of-bounds child indexing in control
 // nodes, numeric parsing of attributes, scripting runtime errors.
 
-#include "behaviortree_cpp/bt_factory.h"
 #include "behaviortree_cpp/blackboard.h"
+#include "behaviortree_cpp/bt_factory.h"
 #include "behaviortree_cpp/xml_parsing.h"
 
-#include <fuzzer/FuzzedDataProvider.h>
-
 #include <cstdint>
 #include <cstdio>
 #include <string>
 #include <vector>
 
+#include <fuzzer/FuzzedDataProvider.h>
+
 namespace
 {
 
@@ -40,14 +40,11 @@ const char* kNames[] = { "n1", "act", "cond", "root_task", "aux" };
 
 // Scripts used by Script/ScriptCondition/Precondition/TestNode. All short,
 // terminating and side-effect limited to the blackboard.
-const char* kConditionScripts[] = {
-  "var > 0", "var < 5", "flag", "!flag", "dbl < 10.0", "str == 'abc'",
-  "var == MODE_A"
-};
-const char* kActionScripts[] = {
-  "var = var + 1", "var = 3", "var = var - 1", "str = 'fuzz'",
-  "dbl = var * 0.5", "flag = !flag", "var = MODE_A", "flag = var > 2"
-};
+const char* kConditionScripts[] = { "var > 0",    "var < 5",      "flag",         "!flag",
+                                    "dbl < 10.0", "str == 'abc'", "var == MODE_A" };
+const char* kActionScripts[] = { "var = var + 1", "var = 3",         "var = var - 1",
+                                 "str = 'fuzz'",  "dbl = var * 0.5", "flag = !flag",
+                                 "var = MODE_A",  "flag = var > 2" };
 const char* kLiterals[] = { "1", "2", "true", "false", "1.5", "hello", "{var}" };
 const char* kStatuses[] = { "SUCCESS", "FAILURE", "SKIPPED" };
 
@@ -93,8 +90,7 @@ std::string genLeaf(FuzzedDataProvider& fdp)
       return "<Script code=\"" + pickScript(fdp) + "\"/>";
     case 3:
       return "<ScriptCondition code=\"" + pickCondition(fdp) + "\"/>";
-    case 4:
-    {
+    case 4: {
       if(fdp.ConsumeBool())
       {
         return std::string("<SetBlackboard output_key=\"var2\" value=\"") +
@@ -109,8 +105,7 @@ std::string genLeaf(FuzzedDataProvider& fdp)
       return "<UnsetBlackboard key=\"var2\"/>";
     case 7:
       return "<Script code=\"{txt}\"/>";
-    default:
-    {
+    default: {
       if(fdp.ConsumeBool())
       {
         return "<Script code=\"" + pickScript(fdp) + "\" name=\"" + pickName(fdp) +
@@ -155,9 +150,8 @@ std::string genDecorator(FuzzedDataProvider& fdp, int depth)
     case 3:
       return "<KeepRunningUntilFailure>" + child + "</KeepRunningUntilFailure>";
     case 4:
-      return "<RunOnce then_skip=\"" +
-             std::string(fdp.ConsumeBool() ? "true" : "false") + "\">" + child +
-             "</RunOnce>";
+      return "<RunOnce then_skip=\"" + std::string(fdp.ConsumeBool() ? "true" : "false") +
+             "\">" + child + "</RunOnce>";
     case 5:
       // never -1: that would be an infinite loop
       return "<Repeat num_cycles=\"" +
@@ -170,12 +164,12 @@ std::string genDecorator(FuzzedDataProvider& fdp, int depth)
              "</RetryUntilSuccessful>";
     case 7:
       return "<Timeout msec=\"" +
-             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 50)) + "\">" +
-             child + "</Timeout>";
+             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 50)) + "\">" + child +
+             "</Timeout>";
     case 8:
       return "<Delay delay_msec=\"" +
-             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 10)) + "\">" +
-             child + "</Delay>";
+             std::to_string(fdp.ConsumeIntegralInRange<unsigned>(1, 10)) + "\">" + child +
+             "</Delay>";
     case 9:
       return "<Precondition if=\"" + pickCondition(fdp) + "\" else=\"" +
              std::string(fdp.PickValueInArray(kStatuses)) + "\">" + child +
@@ -214,21 +208,19 @@ std::string genControl(FuzzedDataProvider& fdp, int depth)
     case 4:
       return "<ReactiveFallback>" + genChildrenBody(fdp, depth, n) +
              "</ReactiveFallback>";
-    case 5:
-    {
+    case 5: {
       const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
       return "<Parallel success_count=\"" +
              std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
              "\" failure_count=\"" +
-             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
-             "\">" + genChildrenBody(fdp, depth, children) + "</Parallel>";
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) + "\">" +
+             genChildrenBody(fdp, depth, children) + "</Parallel>";
     }
-    case 6:
-    {
+    case 6: {
       const size_t children = fdp.ConsumeIntegralInRange<size_t>(1, 3);
       return "<ParallelAll failure_count=\"" +
-             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) +
-             "\">" + genChildrenBody(fdp, depth, children) + "</ParallelAll>";
+             std::to_string(fdp.ConsumeIntegralInRange<size_t>(1, children)) + "\">" +
+             genChildrenBody(fdp, depth, children) + "</ParallelAll>";
     }
     case 7:
       // first child must be the condition branch
@@ -344,7 +336,6 @@ void driveTree(BT::Tree& tree, FuzzedDataProvider& fdp)
   }
 }
 
-
 // A small substitution-rules JSON: replaces matched nodes with TestNodes
 // (bounded async_delay) and uses a wildcard filter so that the wildcard
 // matching code is exercised too.
@@ -382,36 +373,30 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
   {
     switch(fdp.ConsumeIntegralInRange<uint8_t>(0, 2))
     {
-      case 0:
-      {
+      case 0: {
         // plain create + tick
-        const std::string xml =
-            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
-            "</root>";
+        const std::string xml = "<root BTCPP_format=\"4\">" +
+                                wrapTree("MainTree", genNode(fdp, 0)) + "</root>";
         auto tree = factory.createTreeFromText(xml, blackboard);
         driveTree(tree, fdp);
         break;
       }
-      case 1:
-      {
+      case 1: {
         // multiple trees in one document + SubTree reference
         const std::string xml =
             "<root BTCPP_format=\"4\">" +
-            wrapTree("MainTree",
-                     "<Sequence><SubTree ID=\"AuxTree\"/>" + genNode(fdp, 0) +
-                         "</Sequence>") +
+            wrapTree("MainTree", "<Sequence><SubTree ID=\"AuxTree\"/>" + genNode(fdp, 0) +
+                                     "</Sequence>") +
             wrapTree("AuxTree", genLeaf(fdp)) + "</root>";
         factory.registerBehaviorTreeFromText(xml);
         auto tree = factory.createTree("MainTree", blackboard);
         driveTree(tree, fdp);
         break;
       }
-      default:
-      {
+      default: {
         // registry + TestNode substitutions (incl. wildcard filter)
-        const std::string xml =
-            "<root BTCPP_format=\"4\">" + wrapTree("MainTree", genNode(fdp, 0)) +
-            "</root>";
+        const std::string xml = "<root BTCPP_format=\"4\">" +
+                                wrapTree("MainTree", genNode(fdp, 0)) + "</root>";
         factory.registerBehaviorTreeFromText(xml);
         factory.loadSubstitutionRuleFromJSON(kSubstitutionJson);
         const auto& names = factory.registeredBehaviorTrees();
@@ -431,4 +416,3 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 
   return 0;
 }
-